There is also another reason why you need to have at least two tokens:  If I understand correctly, if you need to change the CTL file after it is created, then you need to have at least one of the tokens that was originally used.  Changing the CTL fi...